API reference

Applications

Register and manage your OAuth applications. Each application gets a Client ID and Client Secret used to obtain access tokens. New apps start as PENDING and must be approved by an admin before they can obtain tokens. Requires a signed-in developer account.

POST/oauth/appsDeveloper login

Create an application

Register a new application and receive its client_id and client_secret. The client_secret is shown only once — store it securely. The app is created in PENDING status and cannot obtain tokens until an admin approves it.

Request body example

{
  "name": "My Integration",
  "description": "Sends invoices from our ERP"
}

GET/oauth/appsDeveloper login

List my applications

Return all applications owned by the signed-in developer.

GET/oauth/apps/{app_id}Developer login

Get an application

Fetch a single application you own.

PATCH/oauth/apps/{app_id}Developer login

Update an application

Update the name or description of an application you own.

Request body example

{
  "name": "Renamed Integration",
  "description": "Updated description"
}

POST/oauth/apps/{app_id}/regenerate-secretDeveloper login

Regenerate client secret

Rotate the client_secret. The new secret is returned once; the old one stops working immediately.

POST/oauth/apps/{app_id}/deactivateDeveloper login

Deactivate an application

Disable the application. Its tokens stop working until reactivated.

POST/oauth/apps/{app_id}/activateDeveloper login

Activate an application

Re-enable a previously deactivated application.

GET/oauth/apps/{app_id}/activityDeveloper login

Get application activity

Return the activity log for the application (token issuance, user/entity/invoice actions, secret rotation).

PreviousCreate an app NextToken